ehr onc final certification - Department of Health Care Services

Complete EHRs or EHR Modules designed to provide this capability to be capable of
being configured by a specific user of Certified EHR Technology or based on
organizational policy to generate alerts when certain actions (defined in the standard) had
taken place. For example, a user-defined event could be when a patient’s health
information is accessed outside of normal business hours. In this case, it was our
expectation that Certified EHR Technology would alert a specific user of the Certified
EHR Technology or the organization’s information security staff. We understand the
point that commenters raise, however, about the potential for misinterpretation of this
certification criterion and the consequent potential burden.
Our overall intent for the third paragraph of this certification criterion was to
ensure that Certified EHR Technology provided the capability for eligible professionals
and eligible hospitals to gain access to a specified portion, or a complete representation,
of the Certified EHR Technology’s audit log. We believe that this capability is essential
for eligible professionals and eligible hospitals for risk analysis and other purposes.
Therefore, in concert with the feedback commenters provided on the second paragraph,
we analyzed whether combining the third paragraph with the second paragraph into a
single paragraph would express a clearer requirement. Accordingly, we have merged the
two paragraphs and have adopted in the final rule a requirement that we believe more
clearly expresses our intent for this certification criterion. We also note for clarification
that the phrase “any of the elements specified by 170.210(b)” would also include, for
example, “date” or that information has been “deleted.”
Finally, we believe that it is important for our privacy and security certification
criteria to remain consistent with the HIPAA Security Rule to the degree that Certified
Page 107 of 228